Description
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Problem types
CWE-552 Files or Directories Accessible to External Parties
Product status
* before 125.10
Credits
Patrick Webster (aushack)
References
raw.githubusercontent.com/...ttp/contentkeeper_fileaccess.rb
www.exploit-db.com/exploits/16923
www.aushack.com/200904-contentkeeper.txt
web.archive.org/...00325220542/http://www.contentkeeper.com/
www.vulncheck.com/...nce-arbitrary-file-access-via-mimencode